Understand Stack Canaries and How They Detect Overflows

Topic Overview

Stack Canaries (Stack Cookies)

A stack canary is a randomly chosen value placed on the stack between local variables and the saved return address. Before the function returns, the canary is checked. If it changed, a buffer overflow occurred and the program aborts via __stack_chk_fail().

How Canaries Work

The compiler inserts checks automatically with -fstack-protector:

1. Prologue loads a canary from a thread-local variable (fs:0x28 on x64)
2. Canary sits between the buffer and the return address
3. Epilogue compares canary to the original value
4. Mismatch calls __stack_chk_fail() and terminates the process

Canary types:

• Terminator canary: contains null, newline, carriage return (stops strcpy)
• Random canary: 32-bit or 64-bit random value chosen at program start
• Random XOR canary: XORed with saved frame pointer

For This Exercise

You will simulate the canary check itself: given the canary value and an overflow payload, determine how many canary bytes survive, find the first byte position where the payload disagrees with the canary, and decide whether __stack_chk_fail() fires. This includes the attacker's view: a payload that reproduces the exact canary bytes (the canary-leak bypass) sails through the check.

Bypassing Canaries

Attackers leak the canary value through format string bugs or partial reads, then include the correct canary in their overflow payload to pass the check. The canary sits in a thread-local slot at fs:0x28 on Linux x64, copied onto the stack at function entry. Building with -fstack-protector-all protects every function, not just those with char arrays, at a small performance cost.

Write a C program that reads a canary (8 bytes, hex), a byte offset where the canary sits, and a payload (hex) from stdin, and simulates the stack-protector check.

Requirements:

• Parse the canary and payload hex strings into byte arrays
• If the payload is too short to reach the canary, report INTACT (write stops before the canary)
• Otherwise compare the payload bytes landing on the canary slot against the canary byte by byte
• Find the first byte index where they differ (0-7), report how many canary bytes survived, and whether __stack_chk_fail fires
• Correctly treat a payload that reproduces the canary bytes as INTACT: this is the canary-leak bypass

Success Criteria:

• The comparison is done byte by byte against the given canary, not by pattern matching on the input
• First-differing index and survivor count are correct, including mid-canary corruptions
• The bypass case (exact canary bytes in the payload) passes the check